React4Shell CVE EDR Detection

Gérald

Customers are asking about whether EDR can detect exploitation of CVE-2025-55182 and CVE-2025-66478

What would be the chain of execution and associated score in case of compromission ?

Sethu Laks

Hi @Gérald

Thank you for reaching out the WithSecure community,

EDR solutions (like WithSecure EDR) are designed to detect the post-exploitation activity that typically follows a successful attack, such as:

• Unusual or suspicious processes started by the web server (e.g., node, nginx, or httpd launching command shells, PowerShell, or unknown binaries).
• Attempts to download or execute malware (cryptominers, backdoors, etc.).
• Unexpected network connections to external or known malicious servers (C2 activity).
• Persistence mechanisms or lateral movement attempts.

Severity & Scoring: Any detection related to these exploits will be flagged as high or critical risk by EDR, due to the potential for full system compromise.

What to Watch For:

• Alerts about new or suspicious child processes from your web server.
• EDR detections of known malware or tools being dropped/executed.
• Unusual outbound network traffic from the server.

Summary: While EDR may not always catch the initial exploit (since it’s just a web request), it is very effective at detecting the attacker’s next steps. Make sure your EDR is up to date and review any high-severity alerts related to your web servers.

Best regards,
Sethu
Community Moderator | Technical Support Engineer, https://www.withsecure.com